magento.watch
Server Details
Magento Open Source, Adobe Commerce and Mage-OS releases, EOL, requirements, CVEs and patches
- Status
- Healthy
- Uptime
- 100.0% over 22 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2024-11-05
- URL
- ChatGPT
- –
- Claude
- –
TDQS
Scored across 13 tools
Most tools have clearly distinct purposes, but there is some overlap among the five version-listing tools (get_all_versions, get_supported_versions, get_eol_versions, get_latest_version, get_version) and between get_version's security summary and check_version_security. Descriptions explicitly cross-reference each other to mitigate confusion, but an agent could still occasionally misselect.
All tool names use snake_case with a consistent verb_noun pattern (check_, find_, get_) and clear resource nouns. There are no deviations or mixed conventions, making the naming highly predictable.
13 tools is appropriate for the breadth of the Magento version, security, and patch advisory domain, but the five version-retrieval tools could potentially be consolidated into a single parameterized tool. Still, each tool earns its place and the count is not excessive.
The surface covers version lifecycle, security bulletins, compatibility checks, QPT patches, and upstream fixes, with both search (find_*) and detail (get_*) retrieval. No obvious gaps exist for the stated purpose of Magento version and security advisory lookup.
Available Tools
13 toolscheck_compatibilityCInspect
Check if a specific PHP, MySQL, or other dependency version is compatible with a Magento version
| Name | Required | Description | Default |
|---|---|---|---|
| dependency | Yes | Dependency name (e.g., "php", "mysql", "elasticsearch", "redis") | |
| distribution | Yes | ||
| magentoVersion | Yes | Magento version (e.g., "2.4.8") | |
| dependencyVersion | Yes | Dependency version to check (e.g., "8.3", "8.0") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states what is compared but not whether the result is a boolean, a constraints table, or an error when the version is unknown, and it says nothing about read-only nature, data source, or failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single efficient sentence with no filler, and the target resource is front-loaded. It is terse to the point of under-specification, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should indicate what a compatibility check returns (status, constraints, or error) and how the four required inputs interact. None of that is present, leaving the agent with a name-only understanding of a fully-required four-parameter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 75%, so most parameters are already documented. The description adds that 'dependency' spans PHP, MySQL, and other packages, mildly reinforcing the schema example, but the enum 'distribution' parameter is never explained in the description and the dependency/magentoVersion pairing is only implied.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Check ... compatible') and names both resources: a dependency version and a Magento version. This distinguishes it from siblings like check_version_security (security) and get_supported_versions (enumeration), though it never names an alternative explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, prerequisites, or comparison to siblings. The agent must infer from the name alone that this is for version-compatibility questions rather than security or EOL lookups, which sibling tools cover.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_version_securityAInspect
Check whether a specific Magento/Adobe Commerce version is vulnerable to known security bulletins, and which version fixes it. A version is also vulnerable when the only remedy from Adobe is an isolated patch applied on top of that base release; fixedIn is then null. This is the tool to call when a user asks "is my Magento vulnerable" or "which patch fixes CVE-...".
| Name | Required | Description | Default |
|---|---|---|---|
| version | Yes | Version number (e.g., "2.4.7", "2.4.7-p3") | |
| distribution | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses a non-obvious edge case — that a version is vulnerable when the only remedy is an isolated patch and fixedIn is then null — which is genuine behavioral context. But it says nothing about permissions, error behavior, or result shape beyond that one field.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: purpose first, the fixedIn edge case second, and the routing trigger third. No filler and the core capability is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter read-only lookup with no output schema and no annotations, the description covers purpose, the key output-field nuance, and invocation triggers, which is close to sufficient. The main residual gap is that the overall response shape and any distribution-specific behavior are unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: version is documented in the schema while distribution has no description. The description frames 'version' as a Magento/Adobe Commerce version but adds no syntax, format, or distribution-selection guidance beyond the schema, so it neither compensates for the gap nor is fully redundant.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Check whether a specific Magento/Adobe Commerce version is vulnerable... and which version fixes it') and implicitly distinguishes itself from siblings like get_security_bulletins and find_patch by framing the operation around a specific version rather than listing bulletins or patches.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit routing cues with quoted user intents ('is my Magento vulnerable', 'which patch fixes CVE-...'), which is strong when-to-use guidance. It does not, however, name the alternatives (e.g., get_security_bulletin, find_patch) or state when not to use this tool, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_patchAInspect
Find Adobe Quality Patches Tool (QPT) patches for a Magento Open Source or Adobe Commerce version. With only distribution and version it lists every applicable patch. Add query (symptoms, error text, feature words or a patch id like ACSD-56760), modules (e.g. "catalog", "module-sales") or categories (QPT names like "Admin", "Catalog/Product") to get a ranked list with a 0-100 relevance score and the signals that matched. Covers quality patches only; for security fixes use check_version_security. List mode can return several hundred hits; pass query, modules or categories to rank and limit. Mage-OS is not a QPT target and always returns status "unknown".
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Ranked mode only, default 10 | |
| query | No | Free text: symptoms, error message, feature names, or a patch id | |
| modules | No | Module names with or without the magento/module- prefix | |
| version | Yes | Exact Magento version, e.g. "2.4.7-p3" | |
| categories | No | QPT category names | |
| distribution | Yes | ||
| includeInapplicable | No | Also rank patches that do not apply to this version; each hit keeps its real applicable flag |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it delivers: list mode can return hundreds of hits, ranked mode returns a 0-100 score plus matched signals, Mage-OS always yields status 'unknown', and includeInapplicable keeps the real applicable flag. It still omits auth/permission requirements and pagination behavior, so it is strong but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four dense sentences, front-loaded with the core purpose before the ranking mechanics and the two caveats (security routing, Mage-OS). Nothing is wasted, though the long middle sentence packs several ideas together.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description explains the return shape (ranked list, relevance score, matched signals, applicable flag), the volume risk, and the Mage-OS edge case. An agent has everything needed to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 86%, so the baseline is 3, but the description adds real meaning: query accepts symptoms, error text, feature words, or a patch id (ACSD-56760); modules take names with or without the magento/module- prefix; categories are QPT names. It also clarifies that query/modules/categories switch the tool into ranked mode, which the schema alone does not convey.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (find QPT patches) scoped to a Magento Open Source or Adobe Commerce version, and immediately separates itself from the sibling check_version_security. An agent can tell what this tool owns without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use branches: bare distribution+version = full list; adding query/modules/categories = ranked list; security fixes = use check_version_security instead. It also warns that Mage-OS is not a valid QPT target, which prevents a wasted call.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_upstream_fixAInspect
Community fixes merged into magento/magento2 after a release line was cut, with per-version applicability from git apply checks; not Adobe Quality Patches, for those use find_patch. With only distribution and version it lists, newest first, every upstream fix whose code applies cleanly to that version and that the version does not contain yet. Add query (symptoms, error text, feature words or an id like magento2-40867), modules or categories (QPT category names like "GraphQL", "Catalog/Product") to get a ranked list with a 0-100 relevance score and the signals that matched. fixedIn filters by the first release that contains the fix (null for fixes not in any release yet). Mage-OS always returns status "unknown"; a version outside the checked release tags returns status "unknown-version".
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Ranked mode only, default 10 | |
| query | No | Free text: symptoms, error message, feature names, or an upstream fix id | |
| fixedIn | No | Only fixes first released in this version, e.g. "2.4.9"; null for fixes not in any release yet | |
| modules | No | Module names with or without the magento/module- prefix | |
| version | Yes | Exact Magento version, e.g. "2.4.8-p3" | |
| categories | No | QPT category names | |
| distribution | Yes | ||
| includeExcluded | No | Also return entries excluded as features, refactors or test-only changes; each hit keeps its excluded reason |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does well: it discloses default ordering (newest first), the clean-apply/not-yet-contained filter, the ranked-mode relevance scoring with matched signals, and two special status values ('unknown' for Mage-OS, 'unknown-version' for out-of-range versions). It stops short of describing the full response shape or any rate/latency behavior, so it is strong but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose, then progressively narrows to filters and edge-case statuses. It is dense and slightly long, but each clause carries distinct operational information (mode switch, status codes, exclusion behavior) rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter read tool with no annotations and no output schema, the description covers the two operating modes, filter semantics, and exceptional status values that an agent must handle. The main remaining gap is the structure of returned entries in ranked vs list mode, which the description gestures at but does not fully specify.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 88%, so the baseline is 3, and the description adds genuine meaning: query accepts symptoms, error text, feature words or an id formatted like 'magento2-40867'; modules accepts names with or without the magento/module- prefix; fixedIn is 'the first release that contains the fix'. These examples go beyond the terse schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('community fixes merged into magento/magento2 after a release line was cut') plus the per-version applicability model. It explicitly separates itself from the closest sibling by naming find_patch and the different dataset (Adobe Quality Patches).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit when-not with a named alternative ('not Adobe Quality Patches, for those use find_patch'), then describes two distinct invocation modes: bare distribution+version lists everything, while adding query/modules/categories switches to ranked mode. FixedIn and includeExcluded semantics are also explained as usage conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_all_versionsAInspect
Get all versions for a distribution with their lifecycle information. Each version carries securitySummary { status, requiredPatches, upgradeRequired }: isSecureVersion and statusLabel describe the support lifecycle only, so a supported version can still have open bulletins. Call check_version_security for the remedies.
| Name | Required | Description | Default |
|---|---|---|---|
| distribution | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does substantive work: it discloses the return shape (securitySummary { status, requiredPatches, upgradeRequired }) and, crucially, warns that isSecureVersion/statusLabel reflect lifecycle only so a supported version may still have open bulletins. It omits auth/rate-limit/pagination behavior, but the field-semantics caveat is real added value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences, front-loaded with the core action, then the return-shape caveat, then the sibling pointer. Dense with braces/field names but every sentence earns its place; no padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no annotations, yet the description covers the key return fields and their interpretation caveat, and routes to check_version_security for remedies. Adequate for a simple read tool, though it doesn't clarify its relationship to the other version-listing siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single 'distribution' parameter has 0% schema description coverage, but its enum values (magento-community, magento-commerce, mage-os) are self-explanatory. The description only says 'for a distribution' and adds no meaning beyond the schema, so this is a baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Get all versions for a distribution') plus the payload characteristic ('with their lifecycle information'). The scope 'all versions' implicitly differentiates it from get_latest_version, get_supported_versions, and get_eol_versions, but it never names those siblings, so differentiation is left partly to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context (fetch every version's lifecycle/security summary) and an explicit routing instruction: 'Call check_version_security for the remedies.' It does not, however, state when NOT to use this tool or how it relates to the heavily overlapping get_supported_versions / get_eol_versions siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_eol_versionsAInspect
Get versions that have reached end-of-life. Each version carries securitySummary { status, requiredPatches, upgradeRequired }: isSecureVersion and statusLabel describe the support lifecycle only, so a supported version can still have open bulletins. Call check_version_security for the remedies.
| Name | Required | Description | Default |
|---|---|---|---|
| distribution | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does meaningful work by disclosing the returned securitySummary shape and warning that isSecureVersion/statusLabel describe lifecycle only, so a supported version may still have open bulletins — a genuine misinterpretation trap. It omits read-only confirmation, auth needs, ordering, and pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose, then two dense but purposeful sentences covering return shape and cross-tool routing. The second sentence is syntactically heavy but every clause carries information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully explains the key returned fields and their interpretation, and it points to check_version_security for remedies. The remaining gap is the undocumented distribution parameter, which leaves the agent guessing at filtering semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single required 'distribution' parameter, so the description must compensate and it does not mention the parameter at all. The enum values are self-descriptive, which softens the gap, but the description adds nothing about what distribution filters or what values are accepted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource with a scope qualifier ('versions that have reached end-of-life') that cleanly separates it from siblings like get_supported_versions and get_all_versions. An agent can select this tool without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It routes the agent onward ('Call check_version_security for the remedies') and implies this tool is for lifecycle/support questions, but it never states when to use this tool versus get_supported_versions or get_all_versions. Usage is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_latest_versionAInspect
Get the latest stable version for a distribution. Each version carries securitySummary { status, requiredPatches, upgradeRequired }: isSecureVersion and statusLabel describe the support lifecycle only, so a supported version can still have open bulletins. Call check_version_security for the remedies.
| Name | Required | Description | Default |
|---|---|---|---|
| distribution | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and delivers real behavioral value: it names the returned securitySummary fields ({status, requiredPatches, upgradeRequired}) and warns that isSecureVersion/statusLabel reflect lifecycle support only, so a supported version may still have open bulletins. That caveat prevents a costly misinterpretation; only pagination/auth/rate-limit traits are absent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action, followed by the payload warning and the routing pointer. Dense and purposeful, with only mild jargon compression (`securitySummary` field list inline).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by describing the returned fields and their limits, which is exactly what an agent needs to interpret results correctly. The remedy path is pointed to. It is complete enough for a single-enum-parameter lookup tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
One parameter at 0% schema description coverage, so the description does not compensate for the gap. The distribution enum values (magento-community, magento-commerce, mage-os) are largely self-describing, so the practical impact is limited, but no added meaning is supplied beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource with scope: "Get the latest stable version for a distribution." This distinguishes it from get_version, get_all_versions, and get_supported_versions by the "latest stable" qualifier, though it never names those siblings explicitly to make the contrast airtight.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Routes the agent to check_version_security for remedies, which is genuine alternative-selection guidance. However it gives no when-to-use framing for the primary call versus get_version or get_all_versions, and no prerequisites, so usage is largely implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_patchAInspect
Get one Quality Patches Tool patch by id (e.g. "ACSD-56760") with every file variant, its Composer constraint, resolved applicable versions per distribution, modified files, prerequisites, documentation fields and the raw patch URL.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Patch id, e.g. "ACSD-56760" | |
| version | No | Optional version: includes install instructions and a bundle URL for all applicable non-deprecated files, or composer null when none apply. Without a version, returns the bare entry. | |
| distribution | No | Optional distribution for installation. Defaults to magento-commerce when a live Commerce file applies to the version, otherwise magento-community. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations and no output schema, the description carries the full disclosure burden, and it does substantive work by enumerating the returned payload (file variants, Composer constraint, resolved applicable versions per distribution, modified files, prerequisites, docs fields, raw patch URL). It stops short of stating that this is a non-mutating lookup or noting auth/rate-limit behavior, so it is strong but not complete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that opens with verb, resource and lookup key before enumerating payload contents. The enumeration is long but each item is informative rather than filler, so it earns its length, though it is dense enough to be slightly unwieldy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-record lookup with no output schema, the description's field list effectively compensates for the missing return-value documentation. Gaps remain around failure modes (unknown id, version that does not apply) and confirmation that the call is read-only, but the core information an agent needs to invoke it correctly is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents id, version (install instructions + bundle URL semantics) and distribution (default resolution rule). The description only echoes the id example, adding no meaning beyond the structured fields. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb ('Get') + resource ('Quality Patches Tool patch') + lookup key ('by id', with a concrete example 'ACSD-56760'). The singular 'one ... patch by id' implicitly contrasts with the search-oriented sibling find_patch, but the description never names it, so the sibling differentiation is left to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: 'by id' signals a direct-lookup operation versus a search, but there is no explicit when-to-use statement, no mention of the check_compatibility / find_upstream_fix siblings, and no guidance on error behavior for an unknown id. Adequate but leaves the agent to infer routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_security_bulletinAInspect
Get one security bulletin by id, including a plain-text summary, its CVEs, severity, and which versions per distribution contain the fix. Use this when the user names a specific bulletin or asks which patch fixes a given CVE.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Bulletin id (e.g., "APSB24-40") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does disclose the response contents in useful detail, and 'Get' implies a non-destructive read, but it says nothing about behavior for an unknown id, rate limits, or auth requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences: the return payload leads, then the usage condition. No filler, no repetition of the name or title, and every clause carries information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description compensates well by enumerating the returned fields (summary, CVEs, severity, fix versions per distribution). For a single-parameter read tool that is everything an agent needs to select and call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter and schema description coverage is 100%: the schema already documents 'id' with the exact example format ("APSB24-40"). The description restates 'by id' without adding syntax or lookup semantics beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Get one security bulletin by id') and enumerates the payload (summary, CVEs, severity, per-distribution fix versions), which implicitly separates it from the plural sibling get_security_bulletins. It never names a sibling explicitly, so the distinction must still be inferred from 'one' vs. the list tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives two concrete triggering conditions: the user names a specific bulletin id, or asks which patch fixes a given CVE. No alternatives are named and no exclusions given, and the second condition overlaps with find_patch / check_version_security territory, leaving some routing ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_security_bulletinsAInspect
List Adobe/Magento security bulletins (CVEs), optionally filtered by severity or publish date. Use this to list critical bulletins since a given date, or to survey what has been disclosed.
| Name | Required | Description | Default |
|---|---|---|---|
| since | No | Only return bulletins published on or after this date (YYYY-MM-DD) | |
| severity | No | Only return bulletins of this severity |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. 'List' implies a safe read-only enumeration, but the description says nothing about pagination, result limits, ordering, or whether an API key is needed for Adobe/Magento data. For a simple read tool this is passable but thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the core purpose front-loaded and the usage hint immediately after. No redundant padding, though the second sentence partially restates the filters already implied by the first.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-optional-parameter, read-only list tool with no output schema and no annotations, the description covers purpose and use context adequately. The main omission is the plural-vs-singular distinction from get_security_bulletin and any note about result volume or pagination.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both 'since' and 'severity' are fully documented in the schema, including the YYYY-MM-DD format and the enum values. The description only restates the filter semantics at a high level, adding no format or default detail beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List Adobe/Magento security bulletins (CVEs)') and clarifies the optional filters. It does not, however, distinguish itself from the singular sibling get_security_bulletin, which an agent could easily confuse with this bulk-listing tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence gives two concrete usage scenarios ('list critical bulletins since a given date', 'survey what has been disclosed'), which maps cleanly onto the two optional parameters. It stops short of naming an alternative tool or stating when NOT to use it, so it lacks explicit exclusion guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_supported_versionsAInspect
Get only currently supported versions (not EOL, not future releases). Each version carries securitySummary { status, requiredPatches, upgradeRequired }: isSecureVersion and statusLabel describe the support lifecycle only, so a supported version can still have open bulletins. Call check_version_security for the remedies.
| Name | Required | Description | Default |
|---|---|---|---|
| distribution | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, and it delivers a genuinely non-obvious caveat: isSecureVersion/statusLabel describe the support lifecycle only, so a supported version can still have open bulletins. It does not cover auth requirements, rate limits, or result ordering/pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences, front-loaded with the scope constraint, then the return-shape detail, then the sibling hand-off. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must (and does) name the returned securitySummary fields and explain how to read isSecureVersion/statusLabel. An agent has enough to call it correctly and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description never mentions the required `distribution` parameter. However, it is a single self-explanatory enum (magento-community, magento-commerce, mage-os), so the gap is small rather than fatal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource with an explicit scope boundary: 'only currently supported versions (not EOL, not future releases)'. This cleanly separates it from siblings like get_eol_versions and get_all_versions without needing their schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly excludes EOL and future releases, and routes the agent to check_version_security 'for the remedies'. That is clear context plus one named alternative, though it doesn't address when to prefer it over get_latest_version or get_all_versions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_upstream_fixAInspect
Community fixes merged into magento/magento2 after a release line was cut, with per-version applicability from git apply checks; not Adobe Quality Patches, for those use find_patch. Get one upstream fix by id (e.g. "magento2-40867") with its pull request, linked issues, first release containing it, per-tag code match, affected versions, touched packages and files, labels and triage scores. Pass version, and optionally distribution, to get the code match for that version and the Composer bundle URL when the fix applies to it.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Upstream fix id, e.g. "magento2-40867" | |
| version | No | Optional version: adds the code match for that version and the Composer bundle URL, or install null when the fix does not apply to it | |
| distribution | No | Optional distribution for installation, default magento-community |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it enumerates what is returned (pull request, linked issues, first release containing it, per-tag code match, affected versions, touched packages and files, labels, triage scores) and discloses the edge case that a version yields 'install null when the fix does not apply to it'. It stops short of stating auth requirements or behavior when the id is unknown, so not a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences: the first front-loads scope and the exclusion, the second covers retrieval and the optional params. The long return-field enumeration is justified because there is no output schema, though the enumeration is heavy enough to slow scanning slightly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description compensates by listing returned fields and the not-applicable/null case, which is what an agent needs to interpret results. Missing only incidental behavior such as lookup-failure handling or whether triage scores are computed or stored.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and each parameter already has its own description covering the id format, the version semantics including the null-install case, and the distribution default. The description largely restates that same content, adding no syntax or format detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Get one upstream fix by id'), defines what the resource is ('community fixes merged into magento/magento2 after a release line was cut'), and explicitly excludes Adobe Quality Patches. An agent can distinguish this from find_patch and the sibling list without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names the alternative for the adjacent-but-different case ('not Adobe Quality Patches, for those use find_patch') and pairs it with the retrieval pattern for the singleton lookup ('by id, e.g. "magento2-40867"'). It also explains the conditional use of the optional params, so when to add version/distribution is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_versionAInspect
Get detailed information about a specific Magento/Adobe Commerce version including release date, EOL date, system requirements, and a security summary: security.fixedBy (security fixes already included in this version) and security.vulnerableTo (open bulletins that still need an upgrade or an isolated patch)
| Name | Required | Description | Default |
|---|---|---|---|
| version | Yes | Version number (e.g., "2.4.8", "2.4.7-p3") | |
| distribution | Yes | The Magento distribution |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden; 'Get' makes the read-only, no-side-effect nature evident and it compensates for the absent output schema by explaining the semantics of security.fixedBy and security.vulnerableTo. It stops at 4 because it says nothing about lookup failures (unknown version/distribution), rate limits, or authentication, which an agent may need when a version is not found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence that opens with the verb and resource before unpacking the return fields. The inline parenthetical glosses on the two security fields are dense but each earns its place; no filler sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must (and does) explain the payload, naming the key sections and disambiguating the two security sub-fields. Error/not-found behavior is the only meaningful omission for a two-required-parameter lookup tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: both parameters are documented, with an example version format ('2.4.8', '2.4.7-p3') and an enum for distribution. The description adds no format or constraint detail beyond that, so the baseline 3 is correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb+resource: 'Get detailed information about a specific Magento/Adobe Commerce version', with the returned field set enumerated (release date, EOL, system requirements, security summary). The word 'specific' implicitly separates it from get_all_versions / get_latest_version, but no sibling is named explicitly, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description is purely declarative — it never says when to call this versus check_version_security, get_security_bulletin, or get_all_versions, even though the security summary overlaps heavily with the security-check siblings. No prerequisites, no exclusions, no routing hint.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
13 tool updates
- First observed
check_compatibility - First observed
check_version_security - First observed
find_patch - First observed
find_upstream_fix - First observed
get_all_versions - First observed
get_eol_versions - First observed
get_latest_version - First observed
get_patch - First observed
get_security_bulletin - First observed
get_security_bulletins - First observed
get_supported_versions - First observed
get_upstream_fix - First observed
get_version
Related MCP Connectors
Latest versions, LTS windows, and EOL dates for 300+ products. Fresh ground truth for stale models.
Actively exploited? End of life? Which version fixes it? CVE verdicts for server software.
EOL dates, risk scores, CISA KEV exposure, SBOM audits and edge-device EOS for 700+ products.
Manage products, orders, customers, inventory, and store configuration
Related MCP Servers
- AlicenseAqualityAmaintenanceEnables an AI agent to assess Magento 2 / Adobe Commerce projects for target PHP and Magento version compatibility, custom module quality, and dependency security, combining results into concrete upgrade blockers and plans. It provides tools for project status, package update verdicts, module risk scans, release notes, and upgrade planning.8MIT
- AlicenseBqualityCmaintenanceEnables AI assistants to manage Adobe Commerce and Magento 2 instances through business-level tools for catalog, promotions, CMS, and SEO. It features secure OAuth 1.0 authentication, safety guardrails for bulk operations, and built-in diagnostic reports for store health.3822 npm2MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to safely manage Magento 2 / Adobe Commerce back-office tasks such as orders, fulfillment, customers, products, and store operations with guardrails and user-approved writes.1MIT
- FlicenseNot gradedqualityBmaintenanceFreento MCP is a native Magento 2 extension that implements the Model Context Protocol (MCP) — an open standard for connecting AI assistants to external data sources. This server acts as a secure, direct bridge between your Adobe Commerce / Magento 2 store and LLM-powered assistants (like Claude, ChatGPT, and others), allowing you to manage and audit your store using natural language.18-
Glama MCP Gateway
Add one secure layer between your agents and this server.